January 2017 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

no not all dnsbls are a problem. none of the other ones block non-directly related prefixes as a means of extortion into complete breach of contract. there are some 110 of them last time we checked. we only were on the 2 operated by spamhaus. :P so by far... pretty much all dnsbl's list the ips that originate the 'undesired' traffic, which stops it from reaching those that use their service, and that's where it ends for them... that's perfectly acceptable. (as long as it's the actual end user making the decision to use their 'filtering' or not) howeverrrrr... then there is spamhaus... which goes 'oh on 1.2.3.4 is a website of which the url was mentioned in some UCE', let's list 1.2.3.4 and demand complete disconnection at the isp, if they don't do it we list 1.2.3.0/24, if they still don't cooperate with us we'll run some traceroutes and sh ip bgps and see who suppliers their isp with most of their transit and list their networks as well. (and -those- usually -do- use smtp ;) as for 194.109/16. that ain't ours. lol. you didn't actually think i was gonna disclose OUR front operations' prefixes to spamhaus again right? lol. (plus you'll be hard pushed to find an smtp server on any of those anyway - it's obsolete...;) as for the ripe mailinglist being smtp... yes. it unfortunately still is.. and it's about the ONLY thing that still needs smtp, next to signing up to habbo hotel. lol. i haven't started the mail client for anything else in years. lol. face it: smtp is dead, the reason it is dead: is spamhaus itself. making it unreliable. mainly. On 30 ينا, 2017 م 12:52, ox wrote: > On Mon, 30 Jan 2017 12:30:13 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> now, please take your shitty nagging about 'abuse' of your crappy >> silly old smtp protocol, which doesn't even -originate- from our >> networks in the first fucking place, and stick it where the sun >> doesn't shine... as for malware... windows is the malware there... it > <snip snip> > > You are obviously an intelligent person and I am sure you have a lot to > contribute to an emailing list discussing abuse involving smtp where > you have subscribed using smtp, etc etc. > > What would really help (instead of simply /dev/null) would be some type > of structure to your rantings as some of it seems actually valuable and > important but it is mixed in with so much bullshit that it is too much > work and effort to separate the shit from the gold. > > Is your problem with RBL's in general? - Are you saying that all DNSBL > is evil? or just Spamhaus? You obviously have not nulled all 25 - as > poc of your 194.109.24.25:25 is well functional :) > > Also, maybe for clarity - Not all DNSBL uses pre emtive blocking, as we > established Simon Forster said that "All DNSBL are not the same" > > Sorry to be asking something which you may already have said in your > long rants somewhere, just that it will take too long to read all the crap > you wrote - easier to just ask :) > > Andre > > >

2 1

Re: [anti-abuse-wg] RBL policy
by Simon Forster 30 Jan '17

30 Jan '17

> On 30 Jan 2017, at 06:13, ox <andre(a)ox.co.za> wrote: > > Hello All, > > May I please solicit some comments about Abuse Block lists > (Without detracting from RFC 5782 and RFC 6471 or : > https://www.ripe.net/publications/docs/ripe-409 ) > > Firstly, the background for the start of this thread is simply: As the > use of machine learning technology is now also applied and adapted for > the use of cyber criminals (including spammers, scammers, etc) the > rules and what is socially acceptable is and has changed. Global > politics, protectionism, nationalism and the other 'isms' are also > causing change. > > Considering that DNSBL tech is "reactive" (after he abuse) This statement appears to be exclusionary — and is one often levelled against DNSBLs. All DNSBLs are not wholly reactive. Firstly, one needs to acknowledge that all DNSBLs are not they same. Secondly, some listings in some DNSBLs are proactive. i.e. Made before abuse is seen. As I work for the commercial arm of Spamhaus, I know their offerings quite well and can confidently state that some of the Spamhaus block lists contain proactive and/or precautionary listings. I imagine SURBL does likewise. Other block lists probably have similar policies / inputs. Simon > The block time policies of RBLs > *********************************** > There are two main types of block lists: No automatic removal and > automatic removal > > Is the policy to auto de-list after a period of time, still accurate? > > Considering the change in abuse patterns and technology, should the > block times be increased or de-creased? > > Does society require more specialist non auto de-list DNSBLs? > (Would it be helpful to law enforcement to have a "child pornography" > dnsbl? or a phish dnsbl? - or is the reactive time to high in order > for dynamic ipv4? - but on ipv6 allocations to devices could be more > 'permanent'? etc) > > Andre >

2 3

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by Sergey 30 Jan '17

30 Jan '17

There is no such country as 'the republic cyberbunker'. On 01/30/17 14:26, HRH Prince Sven Olaf von CyberBunker wrote: > > the republic cyberbunker nor the countries in which the customers > operate have laws against viagra. too bad for the uk and their spamhaus. > > > On 30 ينا, 2017 ص 11:06, Sergey wrote: >> >> And you earn money on those who send offers for viagra. Let's talk >> turkey. >> >> >> On 01/30/17 14:00, HRH Prince Sven Olaf von CyberBunker wrote: >>> let's make one thing absolutely clear: if your 1960s instant >>> messenger of choice (smtp) doesn't have >>> a friends list, therefore is full of strangers sending you offers >>> for viagra... that is YOUR problem. >>> you either fix YOUR protocol of choice to have, for example, a >>> friends list, OR you gtfo and stop using it.. none of which is OUR >>> problem.. we OWN the internet, we have nothing to do with whatever the >>> hell goes on on your silly old protocol. it's not even 'abuse'. if >>> you get UCE it's working as documented. >>> >>> hate to break the news to you but we won't pull any single plugs >>> just people advertise some urls >>> in antique smtp shit... lolol. just let it die. problem solved. >>> >>> >>> On 30 ينا, 2017 ص 10:53, HRH Prince Sven Olaf von CyberBunker wrote: >>>> >>>> >>>> >>>> >>>> -------- Forwarded Message -------- >>>> Subject: Re: [anti-abuse-wg] RBL policy >>>> Date: Mon, 30 Jan 2017 10:51:40 +0000 >>>> From: HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> >>>> Organization: Republic CyberBunker >>>> To: Simon Forster <simon-lists(a)ldml.com> >>>> >>>> >>>> >>>> On 30 ينا, 2017 ص 09:39, Simon Forster wrote: >>>> >> On 30 Jan 2017, at 06:13, ox<andre(a)ox.co.za> wrote: >>>> >> >>>> >> Hello All, >>>> >> >>>> >> May I please solicit some comments about Abuse Block lists >>>> >> (Without detracting from RFC 5782 and RFC 6471 or : >>>> >>https://www.ripe.net/publications/docs/ripe-409 ) >>>> >> >>>> >> Firstly, the background for the start of this thread is simply: As the >>>> >> use of machine learning technology is now also applied and adapted for >>>> >> the use of cyber criminals (including spammers, scammers, etc) the >>>> >> rules and what is socially acceptable is and has changed. Global >>>> >> politics, protectionism, nationalism and the other 'isms' are also >>>> >> causing change. >>>> >> >>>> >> Considering that DNSBL tech is "reactive" (after he abuse) >>>> > This statement appears to be exclusionary — and is one often levelled against DNSBLs. All DNSBLs are not wholly reactive. >>>> > >>>> > Firstly, one needs to acknowledge that all DNSBLs are not they same. >>>> > >>>> > Secondly, some listings in some DNSBLs are proactive. i.e. Made before abuse is seen. As I work for the commercial arm of Spamhaus, I know their offerings quite well and can confidently state that some of the Spamhaus block lists contain proactive and/or precautionary listings. >>>> > >>>> >>>> > to be exact: the criminal organisation spamhaus their illegal blacklists effected some 20 million ips on our last scan of their entire database contents. (although that's a bit hard to do, as named kept crashing running 24 cores of gethostbyname() on 10ge , so we may have missed a few million here and there) >>>> at a simultanious portscan of the entire ipv4 internet, it turned out >>>> there were only some 200000 smtp servers left however. >>>> > that leads to the conclusion that 99% of the listings is purely there for blackmail purposes, and has nothing to do with your silly old SMTP protocol AT ALL. the only reason to list those others is to put pressure on people to 1: spend manhours on interacting with the (non-sollicited) spamhaus 'organisation' and 2: illegally force people into breach of contract with their clients. >>>> >>>> listing sales department networks of transit carriers to breach national >>>> carriers and connected hosting farms into breach of contract with a >>>> customer, of which steve linford does not like the CONTENT on the >>>> website, kinda, fucks up statistics ay. >>>> >>>> face it: smtp is dead, and needs no 'protection' at all.. also ip >>>> addresses identify nodes in a network, not people. >>>> >>>> also: forcing people to contact spamhaus, causes manhours to be spent on >>>> communication, which is extortion, as we have no contractual relation >>>> with spamhaus whatsoever, so trying to force carriers and isps into >>>> communication with them, is a crime. (although only punishable by 3 >>>> months in .nl ;) >>>> >>>> the 'we don't block anything' argument doesn't go. spamhaus advertises >>>> the fact that they have influence on roughly 1/3rd of mail delivery so >>>> they know damn well that by entering an ip on their list, of a sales >>>> department of a transit carrier, like they did with at least: tata and >>>> tiscali, that they are deliberately obstructing data communications and >>>> therefore violating any and all computer sabotage acts. >>>> >>>> as for the way in which they advertise their BGP feed. let's just say >>>> that we have BGP feeds as well. and we will use them AGAINST spamhaus >>>> again. (it's called an internet exchange you dummy ;) "we advise our >>>> peers to nullroute traffic to spamhaus or give a preferred route to one >>>> of our dns servers which always returns 127.0.0.2" :P >>>> >>>> we still kinda had it with their fuckery. >>>> >>>> they simply should roll over and die. if not they should get some help. >>>> >>>> fun fact: with all the 110 competing 'auto list / auto-de-list' dnsbls >>>> in the world, there never was -any- issue whatsoever... >>>> >>>> having cghq jew linford crying in the jew press that we would be >>>> 'spammers' may have worked to spread slander... however fact of the >>>> matter is that smtp is loong dead and we usually don't even read it, >>>> sometimes don't have servers for it, and in any case, blocked port 25 on >>>> all our networks by default ever since 2004. lolol. (who the FUCK still >>>> uses smtp anyway, and why the hell would 'abuse' of it be an excuse to >>>> disconnect paying customers - if any - as we certainly never could FIND >>>> any "spammers" that could afford our fees ;) >>>> >>>> what we see here is a CGHQ JTRIG operation (Spamhaus) trying to enforce >>>> UK laws and trade policy upon the rest of the internet, it has nothing >>>> to do with 'abuse' spamhaus is a political operation run by the jews at >>>> CGHQ. >>>> >>>> stophaus is a colation of cyberdivisions of armies fighting them. china, >>>> russia, and the republic cyberbunker have every right in the world to >>>> just nuke linford off the surface of this planet. and that's probably >>>> just what we should have done in the first fucking place. >>>> >>>> > I imagine SURBL does likewise. Other block lists probably have similar policies / inputs. >>>> > Simon >>>> > >>>> > >>>> >> The block time policies of RBLs >>>> >> *********************************** >>>> >> There are two main types of block lists: No automatic removal and >>>> >> automatic removal >>>> >> >>>> >> Is the policy to auto de-list after a period of time, still accurate? >>>> >> >>>> >> Considering the change in abuse patterns and technology, should the >>>> >> block times be increased or de-creased? >>>> >> >>>> >> Does society require more specialist non auto de-list DNSBLs? >>>> >> (Would it be helpful to law enforcement to have a "child pornography" >>>> >> dnsbl? or a phish dnsbl? - or is the reactive time to high in order >>>> >> for dynamic ipv4? - but on ipv6 allocations to devices could be more >>>> >> 'permanent'? etc) >>>> >> >>>> >> Andre >>>> >> >>>> > >>>> >>> >> >> -- >> Kind regards, >> CTO at >> *Foton Telecom CJSC* >> Tel.: +7 (499) 679-99-99 >> AS42861 on PeeringDB <http://as42861.peeringdb.com/>, Qrator >> <https://radar.qrator.net/as42861>, BGP.HE.NET >> <http://bgp.he.net/AS42861> > -- Kind regards, CTO at *Foton Telecom CJSC* Tel.: +7 (499) 679-99-99 AS42861 on PeeringDB <http://as42861.peeringdb.com/>, Qrator <https://radar.qrator.net/as42861>, BGP.HE.NET <http://bgp.he.net/AS42861>

2 1

RBL policy
by ox 30 Jan '17

30 Jan '17

Hello All, May I please solicit some comments about Abuse Block lists (Without detracting from RFC 5782 and RFC 6471 or : https://www.ripe.net/publications/docs/ripe-409 ) Firstly, the background for the start of this thread is simply: As the use of machine learning technology is now also applied and adapted for the use of cyber criminals (including spammers, scammers, etc) the rules and what is socially acceptable is and has changed. Global politics, protectionism, nationalism and the other 'isms' are also causing change. Considering that DNSBL tech is "reactive" (after he abuse) The block time policies of RBLs *********************************** There are two main types of block lists: No automatic removal and automatic removal Is the policy to auto de-list after a period of time, still accurate? Considering the change in abuse patterns and technology, should the block times be increased or de-creased? Does society require more specialist non auto de-list DNSBLs? (Would it be helpful to law enforcement to have a "child pornography" dnsbl? or a phish dnsbl? - or is the reactive time to high in order for dynamic ipv4? - but on ipv6 allocations to devices could be more 'permanent'? etc) Andre

1 0

abuse-c implementation
by ripedenis＠yahoo.co.uk 16 Jan '17

16 Jan '17

Colleagues We have started a discussion on the Database Working Group mailing list about resolving the issues with the "abuse-c:" implementation. We are currently identifying the issues and finalising the problem statement. If you would like to join this discussion it would help if you can do so on the DB WG mailing list, then it is all kept in one place. You can find the start of this discussion here:https://www.ripe.net/ripe/mail/archives/db-wg/2017-January/005492.html cheersdenisco-chair DB-WG

1 0

Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity
by Michele Neylon - Blacknight 08 Jan '17

08 Jan '17

Nobody is forcing anyone to use RPZ. There are thousands of IETF documents covering a multitude of technologies, both real and imagined (just look at the avian carriers series). Personally I used to have issues with the concept of RPZ when it was first raised years ago, but my views have changed over time, though apparently you only discovered it a couple of weeks ago. In any case, like so many other technologies, it is a tool. People using RPZ do so for a variety of reasons and they should be free to do so. Many of us use DNSBLs to protect our users’ inboxes from spam, phishing and other junk. RPZ is a different tech, but in the end is just another tool in our toolbox. And please don’t bring Trump (or any other politician) into this. Apart from anything else this is a RIPE list not an ARIN one ☺ Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blacknight.blog/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265, Ireland Company No.: 370845

3 6

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 62, Issue 9
by Marilson 06 Jan '17

06 Jan '17

> However you would need to get past your emotive arguments and focus on clear objective issues. Wrote Michele > Can you maybe help me to formulate this in a non emotive manner? wrote Andre. > So, I truly thank you for your constructive comments as I am stuck at the emotive side... Wrote Andre. @Andre, never lose your emotive side, your emotional way of arguing. This is a evidence that you are not a sociopath and is able to empathize with your fellow human beings. It shows that your concern, even if it is not correct, is legitimate. You worry about the increase in abuse that has already reached alarming levels. Never so few done so much harm to so many. Never. The insults you're getting are proof that you put your finger in the wound. I urge you to turn that finger violently and make public your concern, out of this group. > And please don’t bring Trump (or any other politician) into this. Apart from anything else this is a RIPE list not an ARIN one ? Wrote Michele. 260 billion spam and scam per day. An army of rascals irritating and stealing people's money. The level of abuse and dishonesty has reached alarming levels. ISPs hiding and protecting criminals. As always, civil society will force its rulers to intervene in this catastrophe because politicians fear their constituents. Who will bring politicians to "into this" will be you guys who turned this anti-abuse-wg into a pro-abuse-wg. > Who defines waht is socially acceptable? Wrote Thomas. People like Andre who are still capable of being moved are apt to define what is socially acceptable. All members of modern society, if able to feel emotions, are apt to evaluate what is socially acceptable according to the uses and customs of the time. Already the sociopaths, unable to feel emotions and empathize with their fellow men, do not stop of develop mechanisms that enhance the ability of technology to hide and protect scammers and spammers with the clear objective of increasing traffic on the Internet to increase their profits. These are not able to define what is socially acceptable. They should be in jail. Marilson ********************************************************************************************************************************** From: anti-abuse-wg-request(a)ripe.net Sent: Friday, January 06, 2017 7:57 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 62, Issue 9 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity (Michele Neylon - Blacknight) 2. Re: DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity (ox) 3. Re: DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity (Michele Neylon - Blacknight) 4. Re: DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity (ox) 5. Re: DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity (Thomas Mechtersheimer) 6. Re: DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity (ox) ---------------------------------------------------------------------- Message: 1 Date: Thu, 5 Jan 2017 16:43:44 +0000 From: Michele Neylon - Blacknight <michele(a)blacknight.com> To: ox <andre(a)ox.co.za>, Suresh Ramasubramanian <ops.lists(a)gmail.com> Cc: Luis E. Mu?oz <lem(a)uniregistry.link>, Mark Foster <blakjak(a)gmail.com>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity Message-ID: <5C898951-97F9-4DED-8A3F-D39013F6EDF1(a)blacknight.com> Content-Type: text/plain; charset="utf-8" Nobody is forcing anyone to use RPZ. There are thousands of IETF documents covering a multitude of technologies, both real and imagined (just look at the avian carriers series). Personally I used to have issues with the concept of RPZ when it was first raised years ago, but my views have changed over time, though apparently you only discovered it a couple of weeks ago. In any case, like so many other technologies, it is a tool. People using RPZ do so for a variety of reasons and they should be free to do so. Many of us use DNSBLs to protect our users? inboxes from spam, phishing and other junk. RPZ is a different tech, but in the end is just another tool in our toolbox. And please don?t bring Trump (or any other politician) into this. Apart from anything else this is a RIPE list not an ARIN one ? Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blacknight.blog/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265, Ireland Company No.: 370845 ------------------------------ Message: 2 Date: Fri, 6 Jan 2017 06:47:03 +0200 From: ox <andre(a)ox.co.za> To: Michele Neylon - Blacknight <michele(a)blacknight.com> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity Message-ID: <mailman.3460.1483696627.1952.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=UTF-8 On Thu, 5 Jan 2017 16:43:44 +0000 Michele Neylon - Blacknight <michele(a)blacknight.com> wrote: > Nobody is forcing anyone to use RPZ. There are thousands of IETF > documents covering a multitude of technologies, both real and > imagined (just look at the avian carriers series). > You are missing important facts in your truthful statement... (so I am agreeing with you 100% - But, you need to add the rest of the truth) The Bind software is the dominant DNS software on the planet. The IETF doc, relating to RPZ - is intended for Bind ops. If left unchallenged, RPZ will become a standard (RFC) Which will legitimize it. NONE of the other real and imagined docs you refer to have anywhere near the same potential direct impact. But, as you are arguing this, I am sure that you will tell me why I am wrong? I am sure that you will also send me a link to a document that defines protocols for fraud, theft and crime? Also, where are the lines then? I mean is hacker tools, cracking software, theft and fraud okay and we do not support child porn? Or are you saying that child porn is also okay? Not clear on what you are saying Michelle? Are you saying that RPZ is okay? That there are worse abuse out there and we should not be concerned with dns abuse? I do understand that people are free to use cracker and hacker tools, free to commit theft, fraud and do whatever their little hearts desire. What I am objecting to, is that non ethical software and systems are being legitimized. > > Personally I used to have issues with the concept of RPZ when it was > first raised years ago, but my views have changed over time, though > apparently you only discovered it a couple of weeks ago. In any case, I honestly thought that "someone" would stand up and say something as it is so very wrong that it was unimaginable that it would gain so much traction. > like so many other technologies, it is a tool. People using RPZ do so > for a variety of reasons and they should be free to do so. Many of us > use DNSBLs to protect our users? inboxes from spam, phishing and > other junk. RPZ is a different tech, but in the end is just another > tool in our toolbox. > > And please don?t bring Trump (or any other politician) into this. > Apart from anything else this is a RIPE list not an ARIN one ? > I could have used eu examples, but, this being RIPE... (usa examples are less direct) - The point I made was: The World Has Changed. (that goes for the eu/usa/africa/all) Andre ------------------------------ Message: 3 Date: Fri, 6 Jan 2017 06:30:32 +0000 From: Michele Neylon - Blacknight <michele(a)blacknight.com> To: ox <andre(a)ox.co.za> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity Message-ID: <DC542018-9D33-4087-AB71-05FB14AF049C(a)blacknight.com> Content-Type: text/plain; charset="utf-8" If you want to lodge your opposition with IETF about a potential protocol / standard / $thing there are mechanisms to do so. However you would need to get past your emotive arguments and focus on clear objective issues. What are your issues with RPZ? How are those issues presented? What is the concern that you want to voice? (While you?re free to share them on this list this isn?t IETF, so it won?t have any impact on any RFC .. ) Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blacknight.blog/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265, Ireland Company No.: 370845 ------------------------------ Message: 4 Date: Fri, 6 Jan 2017 09:12:47 +0200 From: ox <andre(a)ox.co.za> To: Michele Neylon - Blacknight <michele(a)blacknight.com> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity Message-ID: <mailman.3461.1483696627.1952.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=UTF-8 On Fri, 6 Jan 2017 06:30:32 +0000 Michele Neylon - Blacknight <michele(a)blacknight.com> wrote: > If you want to lodge your opposition with IETF about a potential > protocol / standard / $thing there are mechanisms to do so. However > you would need to get past your emotive arguments and focus on clear > objective issues. What are your issues with RPZ? How are those issues > presented? What is the concern that you want to voice? > (While you?re free to share them on this list this isn?t IETF, so it > won?t have any impact on any RFC .. ) > As you have said that RPZ is just another tool (to fight abuse) my positions in this wg is to educate, discuss and agitate for change. I cannot do that if I am alone, or if I do not understand why we are where we are. During the thread on the DNS OPS list, I learned that we are where we are because the majority of DNS OPS do not understand that domains are intellectual property and that many of them did not understand abuse. What I have learned up to now, here, is that there is either general apathy or a non understanding of the principles. So, I truly thank you for your constructive comments as I am stuck at the emotive side and I think I suck a bit at proper communication The clear objective issue with RPZ is that it is unethical. Can you maybe help me to formulate this in a non emotive manner? What I have is examples of what RPZ facilitates: In truth Google.com is at a.a.a.a (or ipv6 eq) If user1 asks resolver the IP number for Google.com, the resolver can send false answer of x.x.x.x If user2 asks the same resolver where Google.com is, the resolver can supply false answer of y.y.y.y because user2 is doing the asking If user3 asks the same resolver where Google.com is, the same resolver can answer a.a.a.a In all the above examples where fake (or any) answers were supplied, the resolver also hides the truth of the fake answer, to the user. Andre ------------------------------ Message: 5 Date: Thu, 5 Jan 2017 11:43:33 +0100 From: Thomas Mechtersheimer <thomasm(a)wupper.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity Message-ID: <20170105104333.GK11359(a)mechti.nrw.net> Content-Type: text/plain; charset=us-ascii On Thu, Jan 05, 2017 at 12:04:19PM +0200, ox wrote: >[...] > But, you neglected to add - That is is not socially acceptable to > define protocols for defrauding people, to tell lies, commit deception, Who defines waht is socially acceptable? btw: most phishing pages use HTTP; HTTP is used for fraud and lies (probably more than RPZ will ever be...); but no one objects the use of HTTP as a protocol -- as the protocol by itself has no moral "value"; it's only the use of a protocol for fraud which is not acceptable. >[...] > Heck, if you are honest, and from the responses in this thread, it is > already "best practise" and quite acceptable to use/apply RPZ - as > apparently "many" are doing this and has been doing it for years. Yes; mangling of DNS responses has been done for years; RPZ only defines a standard for this procedure (which is better than having many non-standard ways). >[...] > That RPZ is DNS abuse, in itself, it is an abuse to Internet Society > and it serves to promote Crime. This is your point of view. Could you provide some evidence where RPZ promotes crime etc. (more than it helps preventing it)? Repeating "RPZ is Evil" again and again doesn't convice me, but as you said: we're in a post-truth world... Thomas ------------------------------ Message: 6 Date: Fri, 6 Jan 2017 11:56:21 +0200 From: ox <andre(a)ox.co.za> To: Thomas Mechtersheimer <thomasm(a)wupper.com> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity Message-ID: <mailman.3462.1483696627.1952.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=US-ASCII On Thu, 5 Jan 2017 11:43:33 +0100 Thomas Mechtersheimer <thomasm(a)wupper.com> wrote: > On Thu, Jan 05, 2017 at 12:04:19PM +0200, ox wrote: > >[...] > > But, you neglected to add - That is is not socially acceptable to > > define protocols for defrauding people, to tell lies, commit > > deception, > > Who defines waht is socially acceptable? > Great point :) Society defines its own ethics, morals and values. For example it would be perfectly acceptable to eat other people if we were cannibals :) In modern societies, from African, to Eastern, To American, European, etc. I would argue that there are certain "baselines" For example, it is not acceptable to eat people, as it is also not acceptable to defraud and tell lies. Or do you not agree? > btw: most phishing pages use HTTP; HTTP is used for fraud and lies > (probably more than RPZ will ever be...); but no one objects the use > of HTTP as a protocol -- as the protocol by itself has no moral > "value"; it's only the use of a protocol for fraud which is not > acceptable. > Yes, and the but... Nowhere is there a protocol or defined method in RFC about http's that promotes deception and lies... So, it is not about the technology existing - as was recently pointed out, technology in itself cannot be unethical... It is about the publication of a process that is unethical and if leaved unopposed will, in all probability, lead to a "standard" > >[...] > > Heck, if you are honest, and from the responses in this thread, it > > is already "best practise" and quite acceptable to use/apply RPZ - > > as apparently "many" are doing this and has been doing it for years. > > Yes; mangling of DNS responses has been done for years; RPZ only > defines a standard for this procedure (which is better than having > many non-standard ways). > same as above > >[...] > > That RPZ is DNS abuse, in itself, it is an abuse to Internet Society > > and it serves to promote Crime. > > This is your point of view. Could you provide some evidence where RPZ > promotes crime etc. (more than it helps preventing it)? > Repeating "RPZ is Evil" again and again doesn't convice me, but as you > said: we're in a post-truth world... > I did post an exact example, but here it is again: The clear objective issue with RPZ is that it is unethical. Can you maybe help me to formulate this in a non emotive manner? What I have is examples of what RPZ facilitates: In truth Google.com is at a.a.a.a (or ipv6 eq) If user1 asks resolver the IP number for Google.com, the resolver can send false answer of x.x.x.x If user2 asks the same resolver where Google.com is, the resolver can supply false answer of y.y.y.y because user2 is doing the asking If user3 asks the same resolver where Google.com is, the same resolver can answer a.a.a.a In all the above examples where fake (or any) answers were supplied, the resolver also hides the truth of the fake answer, to the user. Andre End of anti-abuse-wg Digest, Vol 62, Issue 9 ********************************************

1 0

Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity
by Mark Foster 06 Jan '17

06 Jan '17

Replying against my better judgement, as Andre appears to be Trolling for all he's worth. But on the off chance... On Thu, Jan 5, 2017 at 9:32 PM, ox <andre(a)ox.co.za> wrote: > On Tue, 03 Jan 2017 09:42:38 -0800 > "Luis E. Muñoz" <lem(a)uniregistry.link> wrote: > > > On 3 Jan 2017, at 2:30, ox wrote: > > > When it becomes a "STANDARD" (ACCEPTABLE) and nefarious behavior is > > > suddenly "the way things work" - then this is of serious concern. > > > > You seem to be assigning intent to a tool. A hammer in the hands of > > an artist can produce a beautiful form of art while the same hammer > > can be used to hurt someone. It's not the hammer's fault. Besides, > > RPZ is not a requirement to implement the "walled gardens" you're > > describing. The same thing can be achieved by other, simpler means. > > > > by the same argument then it would be perfectly fine for society to > promote the distribution of DDOS tools, zero day hacking tools and, > well methods to defraud Internet users, define best practise for > Phishing, etc. > Acknowledging that tools exist is not the same as condoning their malicious, or inappropriate, use. > > > and no, of course you do not need RPZ to create "walled gardens" > but discussing it "as normal practice" and "the way DNS works" and > "okay" is what serves to legitimize RPZ as "perfectly fine" > > Whereas in truth, it is EVIL. > I'm not sure that anyone's saying that it's accepted practice in the sense that everyone does - or should - do it. My experience is that private network operators, or service providers, have used it for specific reasons that suit them. In the case of a private network, that is entirely the right and choice. In the case of service providers - the old adage 'walk with your feet' applies. If you don't like it, select a different provider. At least in my part of the world, service providers are almost universally against 'mucking up' what is usually otherwise considered a clean and unmangled end-to-end service. Those service providers who do create 'walled gardens', do it for a reason, and the fact they do so is not a secret. > > If you find the "lying" unacceptable, then this is what should be > > targeted, not the tools that are being used -- which BTW have > > positive uses that IMO far outweighs the abuse you're describing. > > Consider this use case: RPZ can be used to prevent a set of known DNS > > names from resolving, stopping the spread of computer malware. > > Moreover, it can also be used to alert operators of infected machines > > that their computers have been compromised. > > > > Trillions and trillions of domain names can resolve to a single ip number. > > Please give me one (as in singular) just ONE example of a domain that > has trillions of IP numbers? > > Removing the hyperbole, there is one very obvious and well established reason for a 1:many relationship of IP's to DNS names: Virtual service hosting. Given that the DNS serves to allow a human-readable name (or names) to point to a resource (by IP), the inverse relationship doesn't seem to serve many purposes (though there is a 1:many scenario, round-robin load balancing, that comes to mind. But again, i've removed your hyperbole which may make these examples irrelevant. > Water does not flow uphill. > > DNS firewalls are stupid. > You are expressing an opinion which is of course, your right. But if you think that somehow you are going to change the minds of some of the _very_ learned minds who participate in this group, you have another thing coming, i'm afraid. > > > I'm at least hesitant to describe any of those as lies. It's just a > > protocol exchange -- my machine asked for a name-to-IP map and > > received a suitable response, even one that actually fitted better > > with my current situation. > > > > You are wrong. > > When your user asks you for Google.com and you lie, this is a lie. > > It is not just a lie, it is fraud. > > If you then still take that a step further and tell different lies to > different users (depends who is asking) > > And, RPZ stil ltakes that a step further, you deceive and hide your > lies from your users > > AND RPZ makes the management of this easy and defines methods how this > is done - It is simply a hacking tool that promotes deception, secrets, > fraud and other criminal activity. > This is all OTT and if it's the basis of your anger and frustration, you're going to do yourself some harm. It's not fraudulent. There's no intend to gain a pecuniary advantage. It's a safety measure[1], one fully disclosed to the user and one that can be bypassed. Again you make excessive use of hyperbole here so I won't further justify your comments with a response. > > > Granted, this is not the only use case. I dislike walled gardens, > > which is why I take measures to avoid them -- yet I won't attack the > > underlying technology because as I said, has far more positive uses. > > > > There are many things about RPZ which is wrong - so many that it is EVIL! > > And I am happy to discuss all the EVIL bits, which starts at the very > foundation of RPZ > and goes all the way up to the roof... > > > > You've made your feelings about RPZ known, but mailing lists are interactive and bidirectional. You don't appear willing to at least respect the right of others in this group to express their disagreements with your opinion by engaging with them rationally, and instead appear to be trying to shout everyone down. I don't think you're doing yourself any favours. I suggest other contributors to this thread weigh carefully their further contributions as from where I sit, this isn't going anywhere. Andre has marginalised himself and revealed a relatively extreme position that he will not compromise on, despite plenty of well reasoned responses. Mark. [1] I'm aware of circumstances where it's not used as a safety measure, and is instead used (or has been used) for some stupid click-intercept-advertising-revenue-crap, which I fully do not support. However Andre is railing against every situation where DNS answers are changed or filtered... and by and large most of this i'm aware of in recent years has been in the interests of security, customer / user protection, and crime fighting / fraud intervention. Quite the opposite of what Andre seems to assert.

3 3

Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity
by Michele Neylon - Blacknight 06 Jan '17

06 Jan '17

If you want to lodge your opposition with IETF about a potential protocol / standard / $thing there are mechanisms to do so. However you would need to get past your emotive arguments and focus on clear objective issues. What are your issues with RPZ? How are those issues presented? What is the concern that you want to voice? (While you’re free to share them on this list this isn’t IETF, so it won’t have any impact on any RFC .. ) Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blacknight.blog/ http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265, Ireland Company No.: 370845

2 1

Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity
by Suresh Ramasubramanian 05 Jan '17

05 Jan '17

My late grandmother said that people who are jaundiced think the whole world is yellow. Andre – we just aren’t engaging in post truth as much as that you need to cure yourself of this jaundice (or maybe step over into the real world from an alternate universe) --srs On 05/01/17, 3:34 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: On Thu, 5 Jan 2017 22:37:36 +1300 Mark Foster <blakjak(a)gmail.com> wrote: > Replying against my better judgement, as Andre appears to be Trolling > for all he's worth. > But on the off chance... > It seems, every time in post-truth, when positions are indefensible, the name calling starts? Calling me messianic, a troll, idiot or an assehole or whatever?

2 1